Content Security Policy: The application security Swiss Army Knife
summary
Content Security Policy claims to block inline script execution and greatly reduce XSS by whitelisting script origins, and it actually prevents third‑party scripts from loading when not listed. It provides inline scripts blocked by default, form-action restricts POST targets to stop credential exfiltration, and report-uri JSON reports that turn browsers into QA reporters. Report‑only mode and incremental rollout let teams find and fix mixed‑content and CDN whitelisting issues before enforcing, and reporting shows the exact offending page and resource.
AI-written summary · about
chapters (10)
- 0:00Intro
- 0:18Content Security Policy The application security Swiss Army Knife
- 0:42Browser support
- 2:20A basic policy
- 4:32Fine tuning
- 5:02Mitigating XSS
- 6:46Additional CSP Directives
- 10:59Testing CSP
- 11:23CSP Reporting
- 13:36Migrating from HTTP to HTTPS
related talks
32mWhat is CSP and Why Haven't You Applied it Yet
46mContent Security Policies: Let's Break Stuff
58mFixing XSS with Content Security Policy
24mTowards a post-XSS world.
39mProtect Your Application with the Content Security Policy HTTP Security Header
22mYou use Content Security Policy, don't you?
01h 04mCSP XXP STS PKP CAA ETC OMG WTF BBQ…
25mHow HTTP Content-Security-Policy can save your romantic evening